AI assistants (MCP)

The INFRO MCP server lets an AI assistant read and operate your organization over the Model Context Protocol: what you spent and where, why a request failed, what a route does, which budget is close to its limit, and a small set of safe changes. It lives at https://mcp.infro.io/mcp. You connect an assistant by signing in from it (OAuth), or with a management token for clients that cannot sign in. Each tool is a documented management API operation, so the scopes, plan, role and audit rules are the management API's own.

It never calls a model and never routes a request. Your assistant's own model calls are made and billed by your assistant and its provider. MCP tool calls are not gateway requests and do not count against your plan's request allowance.

Sign in from your assistant

Add the server URL in your assistant; it opens INFRO in a new browser tab, as other services' connectors do. Sign in, choose one organization, choose what the assistant may do, and allow it. No token is copied anywhere. The assistant then acts as you, with your current role, in that organization only, from the Startup plan. Every member can connect an assistant this way, not only owners and admins; the console shows each assistant's steps under MCP & connectors → AI assistants, and says when it has connected. If you belong to one organization, it is chosen for you and shown before you allow.

claude mcp add --transport http infro https://mcp.infro.io/mcp

codex mcp add infro --url https://mcp.infro.io/mcp
codex mcp login infro

{
  "mcpServers": {
    "infro": {
      "url": "https://mcp.infro.io/mcp"
    }
  }
}

{
  "servers": {
    "infro": {
      "type": "http",
      "url": "https://mcp.infro.io/mcp"
    }
  }
}

• Claude (web, desktop and mobile): Customize → Connectors → Add custom connector, paste the URL, then sign in. On Claude Team and Enterprise an owner can add INFRO once under Organization settings → Connectors; each member then chooses Connect and signs in as themselves.
• ChatGPT: add a custom MCP server in developer mode, paste the URL and choose OAuth.
• Claude Code in a terminal: run the command, then type /mcp, choose infro and Authenticate (or run claude mcp login infro). In the VS Code extension, type /mcp in the chat panel, add the server there with this URL, then Authenticate. In the desktop app or on the web, add INFRO to your Claude account as a connector (as for Claude, below): Claude Code reaches the connectors of the Claude account it is signed in with.
• Codex in a terminal: the second command opens the sign-in. In the Codex app or IDE extension, open the gear menu, MCP settings, Open config.toml, add [mcp_servers.infro] with url = "https://mcp.infro.io/mcp", then press Authenticate beside INFRO in MCP settings. The app, the extension and the CLI share that file.
• Cursor: ~/.cursor/mcp.json (or Add to Cursor in the console). Under Cursor Settings → MCP, INFRO shows Needs login: press Connect, allow in the tab that opens, and the browser hands you back to Cursor.
• VS Code: .vscode/mcp.json (or Add to VS Code in the console); VS Code opens the sign-in the first time the server starts.
• Any other client that supports MCP sign-in (OAuth 2.1): add the URL. INFRO reads a Client ID Metadata Document, or registers the client (RFC 7591) as a public client whose redirect URIs are https or on localhost.
• Windsurf cannot sign in to INFRO yet (its sign-in returns to an app link INFRO has not checked): use a management token, below.

What you allow

INFRO's permission page shows what the assistant may do as areas. Each area has a switch and, where an assistant can make that change, a box for Change beside View; a badge says whether it can view only, view and change, or part of it. Areas the assistant did not ask for are left out, and the page says so. Making changes stays off unless you tick it.

Under the areas, the assistant asks for OAuth scopes; the areas you choose narrow inside them and never go past them:

Each permission only narrows what your role already allows: the assistant sees only the tools your role can use, and the change permission is not offered to a role that can make none of those changes. Changes also need the plan (projects and keys from Startup, the rest from Team). If the assistant later calls a tool it was not allowed, the server answers 403 with WWW-Authenticate: Bearer error="insufficient_scope" naming the scopes the call needs, and the assistant asks you to sign in again for them. If your organization requires two-factor authentication, you need it on before you can allow an assistant.

Connected assistants

MCP & connectors → AI assistants lists the assistants connected to the organization you are in, with what each may do, its state and when it was last used: owners and admins see every member's, signed in or with a token; everyone else sees their own. Settings → Account → Connected assistants lists yours in every organization. Disconnect takes effect on the assistant's next request; it can be connected again by signing in. Removing a member, an account hold, or turning AI assistant access off stops their assistants too.

Manage changes what one assistant may do, area by area, without signing in again: the change holds from its next request. You can give your own assistant anything your plan and role allow; owners and admins can narrow any member's assistant, and only its person can give it more. A token's areas change the same way, and its secret stays.

Signing in again

Access lasts an hour and renews on its own while the assistant is used; after 30 days without use it lapses, and the assistant reads Needs re-auth. Re-authorize shows the one step in that assistant that signs it in again (for example claude mcp login infro, codex mcp login infro, or Connect in Claude's or Cursor's settings); you confirm the organization in the tab, and what it may do stays as you left it. A renewal reused after it was replaced disconnects that assistant.

Connect with a management token

For Windsurf, CI and scripts, or any assistant you would rather give a token. In the console, open MCP & connectors → AI assistants, choose your assistant (for one that can also sign in, choose use a token instead), and create its token in step one. Pick Read (every setting, usage and estimated provider cost, request metadata, findings and the audit log), Read and change (from the Team plan) or Custom (the areas above, one by one), optionally one project, and an expiry of up to a year. The steps below then show that assistant's setup with the token in it, once; each assistant gets its own token. An expired token reads Renew, which makes its successor with the same access. Owners and admins can create these tokens, from the Startup plan.

claude mcp add --transport http infro https://mcp.infro.io/mcp --header "Authorization: Bearer $INFRO_MCP_TOKEN"

{
  "mcpServers": {
    "infro": {
      "url": "https://mcp.infro.io/mcp",
      "headers": {
        "Authorization": "Bearer ${env:INFRO_MCP_TOKEN}"
      }
    }
  }
}

{
  "inputs": [
    {
      "type": "promptString",
      "id": "infro_token",
      "description": "INFRO management token",
      "password": true
    }
  ],
  "servers": {
    "infro": {
      "type": "http",
      "url": "https://mcp.infro.io/mcp",
      "headers": {
        "Authorization": "Bearer ${input:infro_token}"
      }
    }
  }
}

{
  "mcpServers": {
    "infro": {
      "serverUrl": "https://mcp.infro.io/mcp",
      "headers": {
        "Authorization": "Bearer ${env:INFRO_MCP_TOKEN}"
      }
    }
  }
}

[mcp_servers.infro]
url = "https://mcp.infro.io/mcp"
bearer_token_env_var = "INFRO_MCP_TOKEN"

• Claude Code: run it in a terminal; add --scope user to use INFRO in every project. In a shared .mcp.json, use "headers": {"Authorization": "Bearer ${INFRO_MCP_TOKEN}"} so the token stays out of the repository.
• Cursor: ~/.cursor/mcp.json (every project) or .cursor/mcp.json. The console shows this file with your token written in, ready to paste; to keep the token out of the file, use the variable as here and set INFRO_MCP_TOKEN in the environment Cursor starts from.
• VS Code: .vscode/mcp.json. VS Code asks for the token once and stores it securely. The Add to VS Code button does the same.
• Windsurf: Cascade's MCP settings, raw config (mcp_config.json).
• Codex: ~/.codex/config.toml; set INFRO_MCP_TOKEN. The Codex app and IDE extension do not see a shell variable when opened from the Dock or Start menu: put the header in the file instead, http_headers = { "Authorization" = "Bearer <token>" }, and keep the file private.
• Any other client that speaks MCP over Streamable HTTP: the URL above and the header Authorization: Bearer <token>.

Then ask something like "What did we spend on each provider this month?" The server's instructions tell the assistant to start with get_overview. Claude.ai, Claude Desktop and ChatGPT do not take a pasted token: connect them by signing in, above.

Tools

18 tools in three toolsets. A token sees only the tools its scopes, plan and project restriction allow; the full reference is on MCP tools.

Example prompts

Toolsets and read-only mode

Narrow what an assistant sees with the URL or headers: https://mcp.infro.io/mcp?toolsets=observe,configure or X-INFRO-MCP-Toolsets: observe,configure, and ?read_only=1 or X-INFRO-MCP-Read-Only: true. These only narrow: they never add a tool the token cannot use. The same URL and token always list the same tools in the same order.

Security model

• Your sign-in or your token, your role. A signed-in assistant acts as you, with your current role, in the one organization you chose, narrowed by what you allowed. A management token acts as the person who created it, with their current role, narrowed by its scopes. *:read does not include request data, findings or the audit log; those scopes are granted by name.
• Issued for this server only. A sign-in token is accepted only by the MCP server it was issued for (RFC 8707), never by the management API or the gateway. INFRO accepts public clients with PKCE only: it fetches an assistant's client metadata document over https from a public host, or registers the client with redirect URIs that are https or on localhost, whatever authentication it asked for.
• No secrets pass through. No tool takes or returns a provider credential, a gateway key secret, a webhook secret or a Slack URL. An argument shaped like a credential is refused; an output shaped like one is withheld and reported to INFRO.
• No content. Prompts and completions are never returned, whatever your capture setting.
• Changes are confirmed. Write tools need the version you last read (a stale one is refused, never retried), carry accurate annotations so your assistant asks you first, and revoking a key needs its exact label. A change made through MCP never takes ownership from Terraform or the CLI; the result warns you when the next apply would revert it.
• Audited. Every change writes an audit row naming the client "AI assistant (MCP)". Each tool call is logged with its tool, outcome and duration, never its arguments or result, for 90 days.
• Admins stay in control. Owners and admins can turn AI assistant access off for the organization under Settings → Gateway → AI assistants; every MCP request, signed in or with a token, is then refused with 403 mcp_disabled, and the management API is unaffected. MCP & connectors → AI assistants lists every connected assistant, and the API tokens list shows which assistant last used each token and its calls in seven days. You get an email each time you connect an assistant, and the owners are emailed when a member allows one to make changes.

What leaves INFRO

A tool's result goes to your assistant, and from there to the model provider your assistant uses. That is your assistant and your contract, reached with your own credential; INFRO adds no subprocessor and sends nothing on its own. Results contain configuration, metadata and estimated costs, never request content.

Limits

Errors

A tool that cannot do what was asked returns a result with isError: true, a structuredContent.error object (type, code, message, next_step, and where they apply required_scope, required_plan, current_version or retry_after_s), and one line of text: code: message — next step. The connection itself is refused before any tool runs in these cases:

Codes a tool can return include insufficient_scope, plan_feature, project_restricted, resource_not_found, version_conflict, confirmation_mismatch, credential_in_arguments, tool_not_enabled, organization_suspended and too_many_attempts. See Errors.

Protocol

Streamable HTTP, stateless, one JSON response per request. The server speaks MCP revision 2026-07-28 (server/discover, per-request _meta) and the earlier initialize revisions (2025-03-26 to 2025-11-25), so current clients work without a session. GET and DELETE answer 405.

Changelog